feat(phasefinal-web): corporate site stack on ana-docker

Single static page (nginx) fronted by Traefik at www.phasefinal.com, built
from the design brief. Site markup/CSS checked in verbatim from the design
session; fonts self-hosted (SIL OFL) with the @font-face block uncommented,
which every fresh export re-comments.

Routed via a Traefik file-provider config rather than the container labels:
the docker provider on ana-docker was not registering newly-created
containers, so the file router avoids restarting shared ingress. Labels are
retained in compose so the file can be dropped once that is fixed.

stacks/phasefinal-web/conf/nginx.conf

@@ -0,0 +1,18 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Static site; long cache on immutable assets, short on the document so
+    # a dictated edit goes live on the next deploy without a purge.
+    location = / { add_header Cache-Control "public, max-age=300"; try_files /index.html =404; }
+    location ~* \.(woff2|svg|png|ico)$ { add_header Cache-Control "public, max-age=31536000, immutable"; }
+    location ~* \.css$ { add_header Cache-Control "public, max-age=3600"; }
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Referrer-Policy no-referrer always;
+
+    location / { try_files $uri $uri/ =404; }
+}